CVE-2026-71209
HighPublic exploitaudiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded.
Published Aug 5, 2026 · Updated Aug 28, 2026 · Also known as EUVD-2026-53206, GHSA-8885-9f28-m6p3
Key Facts
Patch immediately- CVE-2026-71209 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting audiobookshelf.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 1.9% probability of exploitation in the next 30 days.
- No fixed version is listed yet; check the vendor advisory for mitigations.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
1.9%
Higher than 79.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-71209 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check.
Affected Products
1 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| audiobookshelf | >= 2.19.1 | n/a |
Timeline
Publicly disclosed
Aug 5, 2026
Last updated
Aug 28, 2026
Weakness Type
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-202 Exposure of Sensitive Information Through Data Queries
- CWE-287 Improper Authentication
- CWE-400 Uncontrolled Resource Consumption
References
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25205.json
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71209.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2025-25205
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-71209
- patchhttps://github.com/advplyr/audiobookshelf/commit/bf8407274e3ee300af1927ee660d078a7a801e1c
FAQ
Common Questions.
audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded.
Affected: audiobookshelf versions >= 2.19.1. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-71209 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo